MySQL client allows MySQL server to request any local file

This week I discovered that large ecommerce and government sites got hacked via the Adminer database tool . As it turns out, the root cause is a protocol flaw in MySQL. Curiously, it is described in the official documentation , that says:

The transfer of the file from the client host to the server host is initiated by the MySQL server. In theory, a patched server could be built that would tell the client program to transfer a file of the server’s choosing rather than the file named by the client in the LOAD DATA statement. Such a server could access any file on the client host to which the client user has read access. (A patched server could in fact reply with a file-transfer request to any statement, not just LOAD DATA LOCAL, so a more fundamental issue is that clients should not connect to untrusted servers.)

“In theory”? An Evil Mysql Server which does exactly that can be found on Github, and was likely used to exfiltrate passwords from these hacked sites. And could be used to steal SSH keys and crypto wallets, as interfail points out.

The server has to know the full path of the file on the client for it to succeed. However, by first requesting /self/proc/environ , the server can learn a great deal about the folder structure on the client.

Several clients and libraries have built-in protection for this “feature”, or disable it by default (eg Golang , Python , PHP-PDO ). But not all, as the Adminer case demonstrates. And Adminer probably won’t be the last.

Discuss this topic on Twitter and Reddit .